Security of two-way quantum cryptography against asymmetric Gaussian attacks 
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Recently, we have shown the advantages of two-way quantum communications in continuous 
variable quantum cryptography. Thanks to this new approach, two honest users can achieve a non- 
trivial security enhancement as long as the Gaussian interactions of an eavesdropper are independent 
and identical. In this work, we consider asymmetric strategies where the Gaussian interactions can be 
different and classically correlated. For several attacks of this kind, we prove that the enhancement 
of security still holds when the two-way protocols are used in direct reconciliation. 



INTRODUCTION TO CONTINUOUS VARIABLE 
QUANTUM CRYPTOGRAPHY 

In recent years, quantum information has discovered 
the non-trivial advantages offered by continuous variable 
systems, i.e., quantum systems described by a set of ob- 
servables, like position and momentum, having a contin- 
uous spectrum of eigenvalues |l[ . Accordingly, quantum 
key distribution has been extended to this new framework 
[2j, y, 14, la] and cryptographic protocols based on coher- 
ent states have been proven to be very powerful for their 
experimental feasibility [fa, [7[ • In these quantum key dis- 
tribution protocols, Alice prepares a coherent state (7) 
whose amplitude 7 = (Q + iP)/2 encodes two random 
variables Q and P following two independent Gaussian 
distributions (having zero mean and the same large vari- 
ance). Then, Alice sends the state to Bob, who measures 
it in order to retrieve the encoded information. Such a 
measurement can be: 

(i) A measurement of Q or P, randomly chosen by 
Bob. Such a disjoint measurement is called homo- 
dyne detection and, therefore, we call "homodyne" 
(Horn) the corresponding protocol [J, |6[ . 

(ii) A joint measurement of Q and P. This measurement 
is called heterodyne detection and is equivalent to a 
balanced beam splitter followed by two homodyne 
detectors. We call "heterodyne" (Het) the corre- 
sponding protocol [5|, [Z( . 

In both protocols, Alice and Bob finally share pairs of cor- 
related continuous variables. From these variables they 
can extract a secret binary key via slicing techniques of 
the phase space Q ■ This classical stage is called reconcil- 
iation and can be direct if Bob estimates Alice's original 
variables or reverse if Alice estimates Bob's outcomes 9]. 
Even if these protocols belong to the so-called prepare 
and measure (PM) schemes, they can be equivalently 
formulated in terms of Einstein-Podolsky-Rosen (EPR) 
schemes, where Alice and Bob extract a secret key from 
the correlated outcomes of the measurements made upon 



a shared EPR source. This source is realized by a two- 
mode squeezed vacuum state whose correlation matrix is 
equal to 
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where Z = diag(l, —1), I the 2x2 identity matrix, and 
V is a variance characterizing the source [10j. One can 
easily show that heterodyning one mode of this EPR 
source is equivalent to the remote preparation of a co- 
herent state J 7) whose amplitude 7 is randomly modu- 
lated by a Gaussian of variance V — 1 (see Appendix). 
The EPR formulation of the Horn protocol is depicted 
in Fig. Q] where the attack of a potential eavesdropper, 
Eve, is also shown. According to the standard eavesdrop- 
ping scenario, we consider an individual Gaussian attack 
which is based on the usage of an entangling doner [6[. 
In this attack, each signal sent from Alice to Bob (mode 
B) is mixed with a probe (mode E), via a beam splitter 
of transmission T. This probe is part of an EPR source 
with variance W which is in Eve's hands. At the end of 
the protocol, when Bob reveals the basis (Q or P) chosen 
for each run, Eve will consequently perform the appro- 
priate homodyne measurements (Q or P) on her output 
modes E' and E" . From such measurements, Eve will 
infer Alice's variable (direct reconciliation) or Bob's vari- 
able (reverse reconciliation) . An entangling doner attack 
can be therefore characterized by two parameters, trans- 
mission T and variance W , which can be arranged in the 
unique quantity 



S = W(1-T)T- 



(2) 



representing the variance of the Gaussian noise added 
by the channel. These quantities are evaluated by Alice 
and Bob by publishing part of their correlated continuous 
variables Qb> and Q + , or Pgi and P_ (see Fig.Q]). In this 
way, they perform an error analysis of the channel, which 
provides the correlation matrix V of their shared Gaus- 
sian state pab' and, therefore, their mutual information 
Iab = I(Qb',Q+) (see Appendix). Similarly, they can 



evaluate Iae and I be, and therefore the two key-rates 
Iab — Iae (direct reconciliation) and Iab — Ibe (reverse 
reconciliation) . The security thresholds achieved for high 
modulation (V — > +00) are equal to E = 1 for direct 
reconciliation, and to S = T^ 1 > 1 for reverse reconcili- 
ation. In particular, for direct reconciliation, the optimal 
attack is given by an entangling doner with W = 1, i.e., 
a beam splitter (lossy channel attack). In such a case, 
the threshold simply corresponds to T = 1/2, i.e., 3 dB 
of losses [4j . Similar results [5(] hold for the Het protocol. 




Q(P) 



FIG. 1: Individual entangling doner attack against the Horn 
protocol. (See text for explanation.) The dashed line displays 
a black-box, with an EPR source and a heterodyne detector 
inside, which Alice can use to prepare a randomly displaced 
coherent state I7) . 



TWO-WAY PROTOCOLS 

Even if the underlying physical principles are the same, 
different protocols are able to exploit them with different 
performances. In Ref. 11(, we have shown that a security 
enhancement can be achieved by resorting to a multiple 
quantum communication (QC) between the trusted par- 
ties. In this approach, a bosonic mode is transmitted 
forward and backward between the two parties in order 
to store and distribute the secret information. Here we 
briefly review these protocols and then we study their 
security by assuming attacks which are asymmetric be- 
tween the forward and backward paths. As depicted in 
Fig. [2l we may consider two different types of two-way 
protocols: 



(i) Two-way homodyne (Horn 2 ) protocol. The Horn 2 
protocol extends the Horn protocol to two-way QC. 
In the Horn 2 protocol, Bob has an EPR source 
(with variance V), of which he keeps a mode r 
while he sends the other reference mode R to Al- 
ice. Then, Alice randomly displaces this mode 
in phase-space. This means that she applies a 
displacement operator [lfj D("/) whose amplitude 
7 = (Q+iP)/2 follows a Gaussian distribution with 
(Q 2 ) = (P 2 ) = V and (QP) = (Q) = (P) = 0. 



The final mode B is then sent back to Bob. This 
mode contains Alice's signal 7, since its quadra- 
tures are equal to Qb = Qr + Q and Pb = Pr + P- 
In order to access this signal, Bob homodyncs his 
modes r and B by choosing to measure their po- 
sition or momentum at random. For instance, he 
can decide to measure positions Q r and Qb, so that 
he can construct an optimal estimator of Qr (from 
Q r ) and, then, an estimator Q^ of Q = Qb~Qr- 
Symmetrically, he can measure P r and Pb to infer 
P. The basis chosen for each run of the protocol 
will be classically communicated to Alice at the end 
of protocol, when the two trusted parties will share 
pairs of correlated continuous variables {Q,Q^} 
and {P,P^}. 

(ii) Two-way heterodyne (Het 2 ) protocol. As for the one- 
way protocols, Bob can perform a joint measure- 
ment of Q and P. This is achieved in the Het 2 
protocol which extends the Het protocol to two- 
way QC. Here, Bob heterodynes his modes r and 
B, from whose results he infers the full signal (Q, P) 
of Alice. Notice that this protocol does not need 
any final basis revelation. Further, it can be fully 
implemented with coherent states. In fact, by het- 
erodyning mode r, Bob equivalently prepares a co- 
herent state |r) = -D(T) |0) which is sent to Alice. 
This state is a reference state which contains the 
reference random transformation F known to Bob. 
By applying her random displacement £^(7), Alice 
transforms this state into another coherent state 
|r + 7) which is sent back to Bob via the mode B. 
By subsequent heterodyne detection, Bob is able to 
estimate the total amplitude T + 7 and, therefore, 
to infer 7 from the knowledge of T. 

As discussed in Ref. [11[ the previous two-way protocols 
must be modified into safer hybrid formulations, Horn 1 ' 2 
and Het 1,2 , where two-way QC is randomly switched 
with one-way QC. In the hybrid formulation of these 
protocols, the previous two-way QC is called the "ON 
configuration" and must be randomly switched with an 
"OFF configuration". In the OFF configuration, Alice 
simply detects the reference mode R (via homodyne or 
heterodyne) and sends a new reference mode R back to 
Bob [ll]]. In both the ON and OFF configurations, Al- 
ice and Bob finally disclose part of the data in order to 
perform tomography of the quantum channel. Thanks to 
this information, Alice and Bob can reconstruct Eve's at- 
tack. In particular, they are able to understand if Eve is 
exploiting quantum and/or classical correlations between 
the forward and backward paths (two-mode attacks). If 
this is not the case (one-mode attacks), they use the ON 
instances to generate the secret key. Otherwise, they can 
use the OFF instances 11 1. 




FIG. 2: Two-way quantum cryptography. Inset (i) shows 
the Horn 2 protocol, i.e., the ON configuration of the hybrid 
protocol Horn 1 ' 2 . Inset (ii) shows the Het 2 protocol, i.e., the 
ON configuration of the hybrid protocol Het 1 ' 2 . 



SECURITY AGAINST ASYMMETRIC 
GAUSSIAN ATTACKS 

Notice that in Ref. [ll|, the quantitative cryptoanal- 
ysis is restricted to one-mode Gaussian attacks, where 
independent and identical Gaussian interactions affect 
the forward and backward channels of the two-way quan- 
tum communication. Here, we study an extension of this 
analysis by considering attacks where the Gaussian in- 
teractions are independent but no longer identical. By 
independent interactions we mean interactions which are 
incoherent, i.e., void of quantum correlations. However, 
since these interactions are generally different, they can 
be classically correlated, i.e., specified by correlated pa- 
rameters 



121 ] - A general analysis of these "asymmetric 
Gaussian attacks" is very difficult. For this reason, we 
consider only specific classes which are constructed using 
entangling doners and/or lossy channels. Further, our 
cryptoanalysis concerns direct reconciliation only. Un- 
der these assumptions we are able to prove that the ON 
configuration of the hybrid protocols (two-way QC) still 
provides a security enhancement. 

Let us study the security of the hybrid protocol Horn 1 ' 2 
against (individual) asymmetric Gaussian attacks which 
are based on the combination of entangling doners. Let 
us assume that Alice and Bob generate the secret key 
using the ON configuration of the protocol, i.e., the two- 
way QC. If we label the forward and backward chan- 



nels by i — 1,2 respectively, then we must combine 
two entangling doners with free parameters T\ , W\ and 
T 2 ,W 2 (i.e., added noises Si and T, 2 ). By homodyn- 
ing their outputs in the correct basis, Eve constructs 
an optimal estimator Q( E > [or P^] of Alice's variable. 
This enables her to eavesdrop the mutual information 
Iae = (1/2)1ii(V/Va\e), where the conditional variance 
Va\e — ^qiq( b > = Vpip(B) quantifies Eve's remaining un- 
certainty on Alice's variable. Similarly, Bob's estimator 
Q( B ) [or P( B )] leaves him with a conditional variance 



V, 



V A \i 

one derives 



QW B) 



Vp\ P (B) . For Ti^ 0,1 and V -> +00, 



Vk|s — 



T 2 {1-T 1 )W 1 + {1-T 2 )W 2 
T 2 



(3) 



v = Ul-T^W^ + jl-T^Wr 1 m 

AlE (1-Ti)(l-T 2 ) ' l ' 

Let us consider the minimum of Va|bVa|e> so that Eve 
minimizes her perturbation of the channel (Va\b) while 
maximizing the acquired information (inverse of Va\e)- 
Such a product takes the minimum value Va\bVa\e = 4 
for 



W 2 = 1 and T 2 = [1 + (1 - T{)Wi}- 



(5) 



The latter condition corresponds to considering an entan- 
gling doner with free parameters (Ti, W±) on the forward 
channel, followed by a beam splitter with a classically 
correlated transmission T 2 = /(Ti, W\) on the backward 
channel. In order to derive the security threshold we 
must impose the condition Iab = Iae which is equiv- 
alent to Va\b = V A \ E - By using Eqs. ©, Q and ©, 
we get Wi = (1 - Ti)- 1 and T 2 = 1/2. These parame- 
ters characterize the curve of the threshold attacks which 
have total noise equal to 



Si 



i + t; 



(6) 



It follows that the security threshold of Horn 1 ' 2 satisfies 
£ > 2, to be compared with the security threshold £ = 1 
of the corresponding one-way protocol Horn 1 . In other 
words, when the communication channel is too noisy for 
one-way protocols, it can still be used by two-way proto- 
cols to generate a secret key. 

In order to support further this "superadditivity" , we 
also study the case of asymmetric lossy-channel attacks 
where the two paths of QC are attacked by two beam 
splitters with different (correlated) transmissions T\ and 
T 2 . Once the correct basis is disclosed by Bob, Eve ho- 
modynes their output ports E[ and E' 2 to infer the signal 
(in the individual version of the attack). Since two beam 
splitters are two entangling doners with W\ = W 2 = 1, 
from Eqs. ([3]) and ([4]) we get 



V A \. 



1 - TjT 2 

T 2 



(7) 



and 



Va\e — 



1 - T{T 2 



(1-Ti)(l-T 2 ) 



(8) 



Then, from Va\b — Va\e we get the threshold curve for 
this kind of attack, i.e., 



T 2 = (l-Ti)(l-T 2 



(9) 



The total transmission T = T\T 2 has a maximum equal 
to 3 — 2\/2 on this curve. Such a value corresponds to a 
threshold of about 7.65dB of losses, to be compared with 
the 3dB limit of the one-way protocol. 

More strongly, we prove that this threshold remains 
the same even when we change the nature of the lossy- 
channel attack from individual to collective. In the col- 
lective attack, Eve keeps her output probes until the end 
of the protocol, when she exploits all the classical infor- 
mation exchanged by Alice and Bob to perform a final co- 
herent measurement on all her probes. In such a case, the 
key rate is bounded by Iab — Xe where xe is the Holevo 
information of the ensemble pe — J G(Q)pE{Q)dQ (here 
Pe{Q) is Eve's conditional state, while G{Q) is a Gaus- 
sian with variance (Q 2 ) = V). For T; ^ 0,1 and 
V — > +oo, one can prove (see Appendix) that 



XE 



i ta 



y(l-T 1 )(l-T 2 ) 
1 - T X T 2 



(10) 



In the same limit, Alice and Bob's mutual information is 
given by 



Iai 



V 



V— 

2 \Va\b 



1 



In 



T 2 V 
1 - TiT 2 



(11) 



As a consequence, the threshold condition Iab = Xe 
gives the same curve of Eq. ©, so that the security 
threshold remains 7.65dB. 

Let us now study the security of the hybrid protocol 
Het 1 ' 2 against (collective) asymmetric lossy-channel at- 
tacks. Let us assume again that Alice and Bob use the 
ON configuration to generate the secret key. For Ti ^ 0,1 
and V — ► +oo, one derives Iab = m(T 2 V/2) while Eve's 
accessible information is bounded by 



XE = In 



eV(l-ri)(l-T 2 ) 



(12) 



2(1 - T X T 2 ) 
Then, from the condition Iab = XEi one finds the curve 



7 1 2(l-TiT 2 ) = e (l-r 1 )(l-T 2 ) 



(13) 



On this curve the total transmission T = T\T 2 has a 
maximum equal to e(e + 4) _1 , corresponding to about 
3.93dB. Such a value must be compared with the thresh- 
old of 1.4dB found for the corresponding Het protocol 
[131 ] . Notice that if we allow Bob to perform coherent 
measurements (on all his states) in order to retrieve Al- 
ice's signal (Q,P), then we can reach the same security 



performances of the Horn 1 ' 2 protocol. In such a case, 
in fact, Bob can asymptotically approach the accessible 
information 

eT 2 V 



Xb = hi 



2(1 - TiT 2 ) 



(14) 



for V — > +oo and Tj ^ 0, 1 (see Appendix). From the 
threshold condition xb — Xe = 0, we then get the same 
curve of Eq. @ and, therefore, the same security thresh- 
old of 7.65dB as Hom 12 . 



CONCLUSION 

In conclusion, multi-way quantum cryptography repre- 
sents a new environment to develop and extend quantum 
key distribution protocols. In this paper we have stud- 
ied the security of two-way protocols against Gaussian 
attacks which are asymmetric between the two paths of 
the quantum communication. We have shown that, even 
in the presence of these asymmetric strategies, the su- 
peradditivity of the two-way quantum communication is 
preserved in direct reconciliation. In particular, this is 
true for an important class of asymmetric Gaussian at- 
tacks, i.e., the asymmetric lossy-channel attacks. These 
analyses represent further steps to assess the security of 
two-way schemes in the context of continuous variable 
quantum cryptography. 
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APPENDIX 
Estimators and remote state preparation 

Consider the general scenario where Alice and Bob 
share two modes A and B, whose quadratures £ = 
(Qa, Pa,Qb, Pb) satisfy the canonical commutation re- 
lations [6, Cm] = ZiJim, where 



1 
-1 



1 
-1 



(15) 



Suppose that modes A and B are described by a bipartite 
Gaussian state Pab, with zero displacement d = {£) = 
and correlation matrix (CM) V, with generic entries 
V ;m = (&£ m + £ m &)/2. The CM V is a real and sym- 
metric matrix that must satisfy the Heisenberg principle 



V + iJ > 



(16) 



taking the form (Q 2 A ) (-P|) > 1 f° r the diagonal ele- 
ments. All the quantum and/or classical correlations 
between the modes are described by the CM which we 
assume to be completely known to the parties. 

Then, suppose that Alice homodynes mode A and Bob 
homodynes mode B, both of them projecting onto the 
same quadrature, e.g., Q. Thanks to the shared correla- 
tions, Alice is able to infer Bob's outcome Qb from the 
outcome Qa of her measurement [9j. In fact, from Qa, 
Alice can construct the optimal estimator Q B ' = kQa of 
the variable Qb, where n = (QaQb)(Qa)~ 1 ^ s directly 
computable from the CM. After her estimation, Bob's 
variable Qb, with initial variance Vq b = {Qb), wu 1 be 
reduced to the conditional variable Qb\a 
with conditional variance 



Qb - Q { b ] 



V, 



Qb\Qa 



(Q 2 



B\AI 



(Ql) - 



(Q%) 



{QaQi 

(Qa) 



,4 A) < 



Q ( B A)2 



(17) 



Thanks to Alice's estimation, the Shannon entropy 
H{Qb) = (l/2)hiVQ B of Bob's variable has been 
reduced to the conditional entropy H(Qb\Qa) — 
(1/2) lnVg B |Q A . Therefore, the mutual information of 
Alice and Bob will be given by 



HQb,Qa)=H(Qb)-H{Qb\Q, 



2 V Qb\Qj 



(18) 

Now, if we do not consider Bob's measurement, Alice's 
local measurement corresponds to a remote state prepa- 
ration at Bob's site. In fact, her measurement simply cor- 
responds to a Gaussian quantum operation that projects 
Bob's mode onto a Gaussian state, centered at the point 
{Qb >0} °f phase-space, and with uncertainties equal 
to V QbIQa of Eq. (HB and V Pb{Pa > V q ^ Qa . More 
generally, Alice can remotely prepare a Gaussian state 
by making a joint measurement of her quadratures Qa 
and Pa- For instance, she can perform a heterodyne de- 
tection by inserting her mode A into a balanced beam 
splitter and, then, detecting the quadratures Q + and P_ 
of the output modes '±' (see Fig. [T]). From the out- 
comes {Q+ , P— ) , Alice can construct two optimal esti- 

£_P_, so that Bob's 



mators 



i(+) 



£ + Q + and P B 



(-) 



variables Qb and Pb are reduced to the conditional ones 



i(+) 



>(-) 



!B\+ = ^b - Q K b' and p b\- = Pb - P B , with con- 
ditional variances Vq b \q and Vp B \p_ [computable from 
the CMs of p+B and p_£ according to Eq. 1(17])]. In 
other words, Alice remotely prepares a Gaussian state 
centered at {Q B , Pb } w ^ n uncertainties Vq b \q + and 
Vp B \p_ In particular, if the shared Gaussian state pab 
is an EPR source with variance V [see Eq. ((T|)] then 
VQb\Q+ — Vp B \P- = 1 an< i' therefore, Alice prepares a 



coherent state I7) with amplitude 7 = [Q B + iP B ]/2. 
Due to the probabilistic behavior of the measurement, 
the amplitude 7 represents a complex random variable 
over many instances of the process. Such a variable fol- 
lows a Gaussian distribution with zero mean and sec- 

(-\-)2 

ond moments given by (Q B ) 



= (P B )2 ) = V - 1 and 



{Qb' Pb ') = 0- Therefore, the physical scheme where 



Alice and Bob share an EPR source with variance V and 
Alice heterodynes her mode is equivalent to a black-box 
where Alice prepares a coherent state whose amplitude 
is modulated by a Gaussian distribution with variance 
V — 1. In this sense, prepare and measure schemes using 
coherent states are equivalent to EPR schemes. 



Computation of the relevant entropies 

Consider the case of a collective and asymmetric lossy- 
channel attack against the protocol Horn 12 in the ON 
configuration. This means that Eve exploits two beam- 
splitters of (correlated) transmissions T\ , Ti and per- 
forms a final coherent measurement on all her probes. 
Eve's output modes E[, E' 2 are described by a state 
Pe{Q) which is conditioned to Alice's encoding Q. On 
average, Eve gets an ensemble pe = f G(Q)pE(Q)dQ, 
where G(Q) is a Gaussian distribution with variance 
(Q 2 ) = V. The Holevo information of Eve is then equal 
to xe = Se — Se\a, where Se and Se\a are the Von 
Neumann entropies of pe and pe(Q) (computable from 
the CMs ~Ve and V^^ of the corresponding Gaussian 
states). One can prove that V^ = V12 ® I © I, where 



V 12 = 



/ill 
6*1 



M2I 



- n [v, v) 



with 



and 



p l = Tx + (1 - Ti)V , 

P2 = l + lHl-TaXV-l) , 

9 = V7i(i-:zi)(i-r 2 )(y-i) 



n(y Q ,v P ) = (i-T 2 )[ v ® ® p 



(19) 



(20) 
(21) 
(22) 



(23) 



The Von Neumann entropy Se of the Gaussian state pe 
can be computed from the symplectic eigenvalues 1J] Vk 
of the CM V e according to the formula 



Se = X^K) 



(24) 



fe=i 



where 



9{x) 



x + 1 



In 



x + 1 



x — 1\ ( x — 1 
In 



(25) 



Note that, for x 
asymptotic expression [ill , [l 



+00, the latter function adopts the 



Since V E = Via i 
V\ = v 



-* l + \n{x/2) + 0(x- 1 ) . (26) 

1 1 © I, we have that 

- , v 2 = v+ , v 3 = 1/4, = 1 , (27) 



where v± are the symplectic eigenvalues of V12. For non 
trivial attacks (T, ^ 0, 1) and high modulation (V — v 
+00), the symplectic eigenvalues v± become proportional 
to V . In particular, one has 



u+v_ = ^/detVia -> (1 - Ti)(l - T 2 )F 2 
In the same limit, the entropy becomes 

2 + In 



(28) 



Se = g{v-)+g(v + ) 
= 2 + In 



- lim vdetV 

4 v^+00 



12 



V 2 
JL(i_ Tl )(l-T 2 ) 



(29) 



The conditional entropy S^u can be computed from 
the symplectic eigenvalues of the matrix Vei^. It is easy 
to verify that "V ' e\A can be derived from V^ by substi- 
tuting 0(0, V) for tl(V,V) in Eq. JTSJ. Then, repeating 
the previous steps, one finds 



~>E\A 



2+-ln 



^-(l-Ti)(l-T 2 )(l-TiT 2 ) 



, (30) 



so that xe is equal to Eq. JTI 

Consider now a collective and asymmetric lossy- 
channel attack against the protocol Het 1 ' 2 in the ON 
configuration. Eve's entropy Se is the same as before, 
while the partial entropy Se\a is now conditioned to both 
of Alice's variables Q and P. This entropy can be derived 
from the conditional CM "Ve\Ai which is computed from 
V E by substituting 0(0,0) for ft(V, V) in Eq. (jTSJ). For 
Ti =/= 0, 1 and taking V — ► +00, one finds 



?E\A 



1+ln 



^ 



T X T 2 



(31) 



so that the Holevo information \e is equal to Eq. (fT2"| . 
Now, let us allow Bob to perform a coherent measure- 
ment on all his states, in order to retrieve the full signal 
7 = (Q + 3-P)/2 encoded by Alice. Bob's modes r and 
£?' are described by a state pb{i) which is conditioned 
to Alice's encoding 7. On average, Bob gets an ensemble 
Pb = J G(7)ps(7)d 2 7, where G(j) is a Gaussian distri- 
bution with (Q 2 ) = (P 2 ) = V" and (QP) = 0. The Bob's 
Holevo information is then equal to xb = Sb — Sb\Ai 
where the two Von Neumann entropies Sb and Sb\a are 
computable from the CMs of ps and pb{i) exactly as 
before. One can verify that ps has the CM 



V B = 



VI <pZ 

<pz fc + n(v)]i 



(32) 



where 



and 



ip = ^T X T 2 {V 2 - 1) , 
? = l + TiT 2 (V-l) , 

n(v) = r 2 y . 



(33) 

(34) 

(35) 



For T, 7^ 0, 1 and V — ► +00, the symplectic eigenvalues of 
Vs become proportional to V and the entropy becomes 



Si 



In 



- lim vdet Vb 

4 v^+00 


= 2 + ln 


/T 2 ^ 
V 4 



(36) 

Then, the CM Vb\a of Pb{i) can be computed by sub- 
stituting ft(0) for fi(V) in Eq. f32]). In the usual limit, 
we have V- = 1 and z/ + — > F(l — XiT 2 ), so that 



5 



Bi 



#(^+) 



1 + ln 



|(l-7iT 2 ) 



(37) 



From Eqs. (|3l)|) and (|3T|) . one easily gets Eq. (TT4]) for 
Bob's Holevo information. 
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